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Top Stories 

• Federal authorities from Mobile, Alabama, arrested a Washington, D.C.-area woman June 
3 for allegedly making more than $900,000 worth of fraudulent claims to the Gulf Coast 
Claims Facility related to the 2010 Gulf of Mexico oil spill. -AL.com (See item 2) 

• Researchers identified a new family of point-of-sale (PoS) and Web browser malware 
known as Soraya that has compromised thousands of payment cards. - Securityweek (See 
item 6) 

• Health officials reported that an estimated 18,000 gallons of untreated sewage spilled into 
Hanamaulu stream in Lihue, Hawaii, June 3 after manhole overflowed due to a blocked 
sewer line. - Hawaii News Now (See item 19 ) 

• Six businesses in downtown Pueblo, Colorado, were destroyed or damaged June 3 when a 
fire broke out in an office supply store, then spread to surrounding businesses. - KKTV 11 
Colorado Springs (See item 28) 
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Energy Sector 



1. June 4, Jersey City Jersey Journal - (New Jersey) 6,000 gallons of gas spilled at 
Bayonne IMTT facility, cleanup underway: officials. A fuel tank at Intemational- 
Matex Tank Terminals in Bayonne, New Jersey, overflowed June 2 and spilled 6,000 
gallons of oil onto the soil. Crews contained the vapors and removed a majority of the 
oil spilled as soil cleanup continued while authorities investigated the incident. 

Source: 

http://www.ni.com/hudson/index.ssf/2014/06/fuel spill bayonne industrial park area 
intemational-matex tank terminals june 3 2014 hudson river.html 

2. June 3, AL.com - (Washington, D.C.; Alabama) Washington-area woman charged 
with $900,000 BP oil spill fraud in Mobile. Federal authorities from Mobile, 

Alabama, arrested a Washington, D.C.-area woman June 3 for allegedly making more 
than $900,000 worth of fraudulent claims to the Gulf Coast Claims Facility related to 
the 2010 Gulf of Mexico oil spill. The suspect is accused of helping prepare over 100 
fake claims in the names of other people and using her personal bank account to deposit 
checks written to individuals whose names were used. 

Source: http://blog.al.com/live/2014/06/washington-area woman charged.html 

3. June 3, Orlando Sentinel - (Florida) Human error caused Blue Rhino blast, State 
concludes. The Florida Department of Agriculture and Consumer Services released a 
report June 3 concluding that a July 2013 blast and fire at the Blue Rhino depot in 
Tavares that left 7 workers injured was caused by human error. The incident began 
when a spark from a forklift ignited a cloud of gas, causing a fire that set off hundreds 
of improperly placed 20-pound metal tanks into the air. 

Source: http://www.orlandosentinel.com/news/local/breakingnews/os-blue-rhino-blast- 
human-error-20140603,0,3 169820. story 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

4. June 3, U.S. Department of Labor - (Texas) Texas conveyor manufacturer cited by 
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US Department of Labor’s OSHA following worker fatality. The Occupational 
Safety and Health Administration cited KWS Manufacturing Co. Ltd. for 14 serious 
safety violations and 3 serious health violations at its Burleson facility following an 
inspection prompted by a December 2013 worker fatality. Proposed fines totaled 
$77,000. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=26127 
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Defense Industrial Base Sector 



Nothing to report 
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Financial Services Sector 

5. June 4, Charleston Post and Courier - (South Carolina) FDIC sues to collect $9.2M 
from ex-officers, directors of failed Charleston bank. The Federal Deposit Insurance 
Corporation (FDIC) filed a lawsuit June 2 against seven former directors of the failed 
Atlantic Bank & Trust based in Charleston, seeking over $9.2 mi llion in damages it 
claims were absorbed when the FDIC took over ownership of the bank in June 2011. 
Source: http ://w ww.postandcourier.com/ article/20 1 40604/PC05/ 1 40609748/ 101 0/fdic- 
sues-to-collect-92m-from-ex-officers-directors-of-failed-charleston-bank 

6. June 3, Securityweek - (International) Soraya malware mixes capabilities of Zeus 
and Dexter to target payment card data. Researchers with Arbor Networks identified 
a new family of point-of-sale (PoS) malware known as Soraya that is capable of 
performing memory scraping techniques similar to the Dexter PoS malware as well as 
intercepting Web browser data similar to the Zeus trojan. The researchers found that 
thousands of payment cards have been compromised by the malware, mostly 
originating from financial institutions in the U.S. and Puerto Rico. 

Source: http://www.securitvweek.com/soraya-malware-mixes-capabilities-zeus-and- 
dexter-target-payment-card-data 

7. June 3, KPRC 2 Houston - (Texas) 2 men charged with planting skimming devices 
on Houston ATMs. Two men were arrested June 3 and charged with allegedly placing 
35 skimming devices on 10 Capital One ATMs in the Houston area between November 
2013 and June 2014. U.S. Secret Service agents alleged that the pair captured payment 
card information belonging to 375 customers. 

Source: http://www.click2houston.com/news/2-men-charged-with-planting-skirnming- 
devices-on-houston-atms/263 1 8086 



8. June 3, Los Angeles Times - (California) ‘Hypnotist Bandit’ linked to bank 



robberies in San Gabriel Valley. Police and FBI agents linked a suspect known as the 
“Hypnotist Bandit” to three bank robberies in the San Gabriel Valley since May 27, 
including two robberies in the same day June 3. 

Source: http://www.latimes.com/local/lanow/la-me-ln-hypnotist-bandit-20140603- 
story.html 

9. June 3, U.S. Securities and Exchange Commission - (New York) SEC charges 
Albany, N.Y.-based investment adviser with defrauding clients. The U.S. Securities 
and Exchange Commission filed an emergency enforcement action June 3 against an 
Albany-based investment adviser for allegedly using his firm, The ELIV Group LLC, 
to fraudulently raise over $8.8 mi llion from around 80 investors by misrepresenting the 
performance and safety of the investments. The SEC alleges that the firm has had 
consistent investment losses and that its owner has withdrawn client funds for personal 
use. 

Source: http://www.sec.gov/News/PressRelease/Detail/PressRelease/1370541977904 
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Transportation Systems Sector 

10. June 4, WMAQ 5 Chicago - (Illinois) Outbound Dan Ryan reopens following three- 
vehicle crash. Southbound lanes of the Dan Ryan Expressway in Chicago were shut 
down for several hours June 4 after two semi-trucks and a bus carrying 38 special needs 
adults collided and dumped thousands of papers and debris along the highway. 

Source: http://www.nbcchicago.com/news/local/SB-Lanes-of-Dan-Ryan-Closed-After- 
Crash-261724211.html 

11. June 3, KSDK 5 St. Louis - (Missouri) Overturned tanker blocks traffic. Highway N 
at Castleview Road in Cottleville was closed for about 6 hours June 3 after a semi-truck 
carrying gasoline/and or diesel fuel overturned, sending the driver to a local hospital 
with minor injuries and creating a small spill that was cleaned up by a HAZMAT crew. 
Source: http://www.ksdk.com/storv/news/traffic/2014/06/03/highwav-n-overturned- 
tanker/9925931/ 

12. June 3, U.S. Environmental Protection Agency - (Virginia) EPA settlement with U.S. 
Postal Service helps protect soil and groundwater from underground storage tank 
leaks in Virginia. The United States Postal Service (USPS) certified that five of its 
Virginia facilities are in compliance with State and federal underground storage tank 
regulations as part of a settlement with the U.S. Environmental Protection Agency 
(EPA) after the EPA discovered that the USPS failed to conduct release detection and 
line testing as well as failed to investigate/report a suspected release. The USPS was 
also ordered to pay a civil penalty of $55,258 as part of the settlement. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/5e983398fcb3ec0285257cec0072075570p 

enDocument 
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13. June 3, Santa Rosa Press Democrat - (California) Crash after police pursuit closes 
Highway 12 west of Santa Rosa. The California Highway Patrol closed Highway 12 
east at Irwin Lane near Santa Rosa for several hours to investigate a police chase that 
ended in the suspect crashing into other vehicles and being sent to a local hospital for 
his injuries June 3. 

Source: http://www.pressdemocrat.com/article/20140603/articles/14060985Q 

14. June 2, KSNT 27 Topeka - (Kansas) Train derails in NE Kansas, no injuries 
reported. All lanes of the Kansas 9 roadway in Frankfort, Kansas, were closed June 2 
after 12 cars from a Pacific Railcars train carrying coal from Wyoming to Texas 
derailed. The rail line was closed indefinitely until around a thousand feet of damaged 
rail can be replaced. 

Source: http://kansasfirstnews.com/2014/06/02/train-derailment-in-frankfort/ 

15. June 2, WJZ 13 Baltimore - (Maryland) Baltimore postal worker charged with 
stealing more than 20,000 pieces of mail. A Baltimore postal worker was charged 
with theft and destruction of mail the week of May 26 for allegedly stealing more than 
20,000 pieces of mail between the Parkville Branch and Catonsville Carrier Annex. 
Officers recovered 55 gift cards and 15 credit cards and a number of stolen items in his 
wallet. 

Source: http://baltimore.cbslocal.com/2014/06/02/baltimore-postal-worker-charged- 
with-stealing-20000-pieces-of-mail/?hpt=iu bnl 



T Return to top i 

Food and Agriculture Sector 

16. June 3, U.S. Department of Labor - (Idaho) US Department of Labor's OSHA cites 
Anderson Farms after worker fatally injured at cattle feed mixing facility. Idaho- 
based Anderson Farms was cited by the Occupational Safety and Health Administration 
for 5 workplace safety following an inspection prompted by a worker fatality at the 
company’s Heybum facility in February. Proposed penalties totaled $25,200. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=26142 

17. June 2, U.S. Food and Drug Administration - (National) Baptista’s Bakery Inc. issues 
voluntary recall for LiveGfree Rosemary and Olive Oil Multiseed Snack 
Crackers. The U.S. Food and Drug Administration announced June 2 that Baptista’s 
Bakery, Inc., voluntarily issued a recall for 4,339 cases of its LiveGfree 4.25-ounce 
packages of Gluten Free Rosemary and Olive Oil Multiseed Cracker, after Kerry 
Ingredients, a supplier for the crackers, issued a recall of a seasoning used in the 
product due to possible Salmonella contamination. The product was distributed to 
retailers nationwide. 

Source: http://www.fda.gov/Safety/Recalls/ucm399749.htm 

18. June 2, Sunbury Daily Item - (Pennsylvania) Loss set at $200,000 in fire at Union 
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County dairy farm. Authorities are investigating the source of a 3-alarm fire that 
caused an estimated $200,000 in damage to a dairy fire in Union County, Pennsylvania 
May 31. At least three bams were engulfed by the fire. 

Source: http://www.dailyitem.com/0100 news/xl760087284/Loss-set-at-200-000-in- 
fire-at-Union-County-dairy-farm 
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Water and Wastewater Systems Sector 

19. June 3, Hawaii News Now - (Hawaii) 18,000 gallons of untreated sewage spills into 
Kauai stream. Health officials reported that an estimated 18,000 gallons of untreated 
sewage spilled into Hanamaulu stream in Lihue June 3 after manhole overflowed on the 
east side of Kapaia Bridge due to a blocked sewer line. The public was advised to stay 
out of Hanamaulu Stream and Hanamaulu Bay while authorities worked to clear the 
blocked line and stop the overflow. 

Source: http://www.hawaiinewsnow.com/story/25685289/kauai-crews-work-to- 
contain-sewage-spill 

20. June 3, Minneapolis Star Tribune - (Minnesota) 3 Lake Minnetonka beaches re- 
open, 2 closed. Health authorities in Hennepin County reopened three Lake 
Minnetonka beaches June 3 after tests showed water quality levels were normal after 
the beaches were closed June 1 due to a sewage release in the city of Mound. Two 
other beaches in the area were closed after weekly test results showed they were 
contaminated. 

Source: http://www.startribune.com/local/west/261757661.html 
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Healthcare and Public Health Sector 

21. June 3, CNN - (National) FDA approves drug to treat MRSA. The U.S. Food and 
Drug Administration approved a new drug taken intravenously for use in adults, to treat 
bacterial skin infections like Methicillin-resistant Staphylococcus aureus (MRSA). The 
drug is the first to be labeled as a Qualified Infectious Disease Product. 

Source: http://www.cnn.com/2014/06/03/health/mrsa-fda-drug/index.html 

For another story, see item 22 
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Government Facilities Sector 

22. June 4, Pittsburgh Post-Tribune - (West Virginia) Retired W.Va. state trooper 
indicted for theft of veterans benefits, drugs. A retired West Virginia State Trooper 
and veteran was charged June 3 with stealing more than $480,000 from the U.S. 
government in veterans benefits and pain medication by lying about his decorations and 
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service record. The suspect fraudulently obtained narcotics from a U.S. Department of 
Veterans Affairs hospital from 2010 to 2012 and provided fake documentation claiming 
combat injuries. 

Source: http://www.post-gazette.com/local/region/2014/06/Q4/Retired-W-Va-state- 
trooper-indicted-for-theft-of- veterans-benefits-drugs/stories/20 1 406040 1 44 

23. June 3, Hartford Courant - (Connecticut) Bristol school out for the day after bomb 
threat. Students were evacuated and classes were dismissed at Northeast Middle 
School in Bristol, Connecticut, after a student found a note containing a bomb threat 
June 3. Police spent several hours investigating the scene and issued an all clear after 
nothing suspicious was found. 

Source: http://www.courant.com/communitv/bristol/hc-bristol-bomb-threat-0604- 
20140603,0,7262858.story 

24. June 3, WNWO 24 Toledo - (Michigan) Electrical issue forces evacuation of 
Jackman Road Elementary School. Students were evacuated and classes were 
dismissed at Jackman Road Elementary School in Bedford, Michigan, due to an 
electrical issue originating from a transformer outside the school which prompted 
power to be shut off while officials investigated. Crews restored power and classes 
were scheduled to resume June 4. 

Source: http://www.northwestohio.com/news/storv.aspx?id=1052719 
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Emergency Services Sector 

Nothing to report 
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Information Technology Sector 

25. June 4, The Register - (International) New software nasty encrypts Android PHONE 
files and demands a ransom. Researchers at ESET identified a new piece of Android 
ransomware known as Android/Simplocker that encrypts victims’ data and demands a 
ransom via the MoneXy service. The malware is controlled by a command and control 
server hosted within the TOR network. 

Source: 

http://www.theregister.co.uk/2014/Q6/04/android simplocker file scrambling ransom 
ware/ 

26. June 3, Threatpost - (International) GnuTLS patches critical remote code execution 
bug. GnuTLS released a patch for the open source cryptographic library May 28 that 
closes a critical remote execution vulnerability which could allow an attacker to trigger 
a buffer overflow and cause a server to crash or potentially execute arbitrary code. 
Source: http://threatpost.com/gnutls-patches-critical-remote-code-execution-bug 
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27. June 3, Securityweek - (International) Report examines how attackers mask threat 
activity. Palo Alto Networks released their latest Application Usage and Threat Report 
June 2, which found that attackers continue to use common sharing applications such as 
email and social media to initiate multi-phased attacks, among other findings. 

Source: http://www.securitvweek.com/report-exarnines-how-attackers-mask-threat- 
activity 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

Nothing to report 
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Commercial Facilities Sector 

28. June 4, KKTV 11 Colorado Springs - (Colorado) Six businesses damaged or 
destroyed in massive Pueblo fire. Six businesses in downtown Pueblo, Colorado, 
were destroyed or damaged June 3 when a fire broke out in an office supply store, then 
spread to surrounding businesses. Fire officials temporarily evacuated a nearby parking 
garage as a precaution and warned against being within a two-block radius of the fire 
due to risks posed by the fire’s smoke. 

Source: http://www.kktv.com/home/headlines/Massive-Fire-Burning-In-Downtown- 
Pueblo-261766901.html 

29. June 4, Santa Maria Times - (California) Fire causes $100K in damage to Santa 
Maria business. Firefighters responded June 4 to Rick’s Cabinets in Santa Maria, 
California, when a fire started in a shipping container located behind the store and 
spread into the roof and attic space of the building. Authorities are investigating the 
fire, which caused an estimated $100,000 in damage. 

Source: http://santamariatimes.com/news/local/fire-causes-k-in-damage-to-santa-maria- 
busmess/article 86edf7c2-ebff- 1 1 e3-aa43-00 1 9bb2963f4.html 

30. June 4, Detroit News - (Michigan) Suspect crashes stolen vehicle into Highland 
Park dollar store. Authorities are searching for an individual who crashed a stolen 
vehicle into a Super Dollar Deal store located in a Highland Park strip mall, causing a 
fire inside the building June 4. The store remained closed due to smoke damage and an 
activated sprinkler system inside the building. 

Source: 
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http ://w w w .detroitnews . com/article/20 1 40604/METRQ0 1 /306040066/ 1361 /S uspect- 
crashes-stolen-vehicle-into-Highland-Park-dollar-store 



31. June 3, Associated Press - (Ohio) Ohio theme park ride running again, a day after 
motor smoke caused closure, evacuation. Officials from Kings Island theme park in 
Mason reopened its Flight of Fear indoor roller coaster ride June 3 following a 
malfunction of the motor that caused smoke inside the structure June 2. Two 
individuals were treated for smoke inhalation while the building was evacuated and 
ventilated and the motor was replaced. 

Source: 

http://www.greenfieldreporter.eom/view/storv/b98cb512851c4fdfaacdff4b326277aa/0 
H— Kings-Island-Smoke 

32. June 2, WLEX 18 Lexington - (Kentucky) Around 20 people displaced after 
apartment fire. Six apartment units were destroyed and about 20 residents were 
displaced after a Lexington apartment building caught fire June 3. Authorities are 
investigating the incident but believe the fire started at a fence next to the building then 
traveled up into the attic and through the rough of the structure. 

Source: http://www.lexl8.com/news/around-20-people-displaced-after-apartment-fire 
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Dams Sector 



Nothing to report 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq .dhs. gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert. gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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